To demonstrate the sensitivity of ML-based malware detectors to dataset composition and size, we ran experiments comparing the efficacy of models trained with commercial large-scale (Ember) and small-scale datasets (the public Microsoft and Brazilian datasets described above). Results use the recent MalConv detector [1]}, and follow the setup described in § (testing is done on the 200K Ember test set). To contextualize these results, we note that the implications of detecting even a single additional malicious binary in the wild can be substantial (§), and that single-digit accuracy improvements are celebrated by malware analysts [2]}.
